2 * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "kpasswd_locl.h"
37 #include <kadm5/admin.h>
42 #include <kadm5/private.h>
44 static krb5_context context
;
45 static krb5_log_facility
*log_facility
;
47 static struct getarg_strings addresses_str
;
48 krb5_addresses explicit_addresses
;
50 static sig_atomic_t exit_flag
= 0;
53 add_one_address (const char *str
, int first
)
58 ret
= krb5_parse_address (context
, str
, &tmp
);
60 krb5_err (context
, 1, ret
, "parse_address `%s'", str
);
62 krb5_copy_addresses(context
, &tmp
, &explicit_addresses
);
64 krb5_append_addresses(context
, &explicit_addresses
, &tmp
);
65 krb5_free_addresses (context
, &tmp
);
77 uint16_t len
, ap_rep_len
;
82 ap_rep_len
= ap_rep
->length
;
86 len
= 6 + ap_rep_len
+ rest
->length
;
88 *p
++ = (len
>> 8) & 0xFF;
89 *p
++ = (len
>> 0) & 0xFF;
92 *p
++ = (ap_rep_len
>> 8) & 0xFF;
93 *p
++ = (ap_rep_len
>> 0) & 0xFF;
95 memset (&msghdr
, 0, sizeof(msghdr
));
96 msghdr
.msg_name
= (void *)sa
;
97 msghdr
.msg_namelen
= sa_size
;
99 msghdr
.msg_iovlen
= sizeof(iov
)/sizeof(*iov
);
101 msghdr
.msg_control
= NULL
;
102 msghdr
.msg_controllen
= 0;
105 iov
[0].iov_base
= (char *)header
;
108 iov
[1].iov_base
= ap_rep
->data
;
109 iov
[1].iov_len
= ap_rep
->length
;
111 iov
[1].iov_base
= NULL
;
114 iov
[2].iov_base
= rest
->data
;
115 iov
[2].iov_len
= rest
->length
;
117 if (sendmsg (s
, &msghdr
, 0) < 0)
118 krb5_warn (context
, errno
, "sendmsg");
122 make_result (krb5_data
*data
,
123 uint16_t result_code
,
129 sp
= krb5_storage_emem();
130 if (sp
== NULL
) goto out
;
131 ret
= krb5_store_uint16(sp
, result_code
);
133 ret
= krb5_store_stringz(sp
, expl
);
135 ret
= krb5_storage_to_data(sp
, data
);
137 krb5_storage_free(sp
);
142 krb5_storage_free(sp
);
144 krb5_warnx (context
, "Out of memory generating error reply");
149 reply_error (krb5_realm realm
,
153 krb5_error_code error_code
,
154 uint16_t result_code
,
158 krb5_data error_data
;
160 krb5_principal server
= NULL
;
162 if (make_result(&e_data
, result_code
, expl
))
166 ret
= krb5_make_principal (context
, &server
, realm
,
167 "kadmin", "changepw", NULL
);
169 krb5_data_free (&e_data
);
174 ret
= krb5_mk_error (context
,
184 krb5_free_principal(context
, server
);
185 krb5_data_free (&e_data
);
187 krb5_warn (context
, ret
, "Could not even generate error reply");
190 send_reply (s
, sa
, sa_size
, NULL
, &error_data
);
191 krb5_data_free (&error_data
);
195 reply_priv (krb5_auth_context auth_context
,
199 uint16_t result_code
,
203 krb5_data krb_priv_data
;
204 krb5_data ap_rep_data
;
207 ret
= krb5_mk_rep (context
,
211 krb5_warn (context
, ret
, "Could not even generate error reply");
215 if (make_result(&e_data
, result_code
, expl
))
218 ret
= krb5_mk_priv (context
,
223 krb5_data_free (&e_data
);
225 krb5_warn (context
, ret
, "Could not even generate error reply");
228 send_reply (s
, sa
, sa_size
, &ap_rep_data
, &krb_priv_data
);
229 krb5_data_free (&ap_rep_data
);
230 krb5_data_free (&krb_priv_data
);
234 * Change the password for `principal', sending the reply back on `s'
235 * (`sa', `sa_size') to `pwd_data'.
239 change (krb5_auth_context auth_context
,
240 krb5_principal admin_principal
,
248 char *client
= NULL
, *admin
= NULL
;
249 const char *pwd_reason
;
250 kadm5_config_params conf
;
251 void *kadm5_handle
= NULL
;
252 krb5_principal principal
= NULL
;
253 krb5_data
*pwd_data
= NULL
;
255 ChangePasswdDataMS chpw
;
257 memset (&conf
, 0, sizeof(conf
));
258 memset(&chpw
, 0, sizeof(chpw
));
260 if (version
== KRB5_KPASSWD_VERS_CHANGEPW
) {
261 ret
= krb5_copy_data(context
, in_data
, &pwd_data
);
263 krb5_warn (context
, ret
, "krb5_copy_data");
264 reply_priv (auth_context
, s
, sa
, sa_size
, KRB5_KPASSWD_MALFORMED
,
265 "out out memory copying password");
268 principal
= admin_principal
;
269 } else if (version
== KRB5_KPASSWD_VERS_SETPW
) {
272 ret
= decode_ChangePasswdDataMS(in_data
->data
, in_data
->length
,
275 krb5_warn (context
, ret
, "decode_ChangePasswdDataMS");
276 reply_priv (auth_context
, s
, sa
, sa_size
, KRB5_KPASSWD_MALFORMED
,
277 "malformed ChangePasswdData");
282 ret
= krb5_copy_data(context
, &chpw
.newpasswd
, &pwd_data
);
284 krb5_warn (context
, ret
, "krb5_copy_data");
285 reply_priv (auth_context
, s
, sa
, sa_size
, KRB5_KPASSWD_MALFORMED
,
286 "out out memory copying password");
290 if (chpw
.targname
== NULL
&& chpw
.targrealm
!= NULL
) {
291 krb5_warn (context
, ret
, "kadm5_init_with_password_ctx");
292 reply_priv (auth_context
, s
, sa
, sa_size
,
293 KRB5_KPASSWD_MALFORMED
,
294 "targrealm but not targname");
299 krb5_principal_data princ
;
301 memset(&princ
, 0, sizeof (princ
));
302 princ
.name
= *chpw
.targname
;
303 princ
.realm
= *chpw
.targrealm
;
304 if (princ
.realm
== NULL
) {
305 ret
= krb5_get_default_realm(context
, &princ
.realm
);
309 "kadm5_init_with_password_ctx: "
310 "failed to allocate realm");
311 reply_priv (auth_context
, s
, sa
, sa_size
,
312 KRB5_KPASSWD_SOFTERROR
,
313 "failed to allocate realm");
317 ret
= krb5_copy_principal(context
, &princ
, &principal
);
318 if (*chpw
.targrealm
== NULL
)
321 krb5_warn(context
, ret
, "krb5_copy_principal");
322 reply_priv(auth_context
, s
, sa
, sa_size
,
323 KRB5_KPASSWD_HARDERROR
,
324 "failed to allocate principal");
328 principal
= admin_principal
;
330 krb5_warnx (context
, "kadm5_init_with_password_ctx: unknown proto");
331 reply_priv (auth_context
, s
, sa
, sa_size
,
332 KRB5_KPASSWD_HARDERROR
,
333 "Unknown protocol used");
337 ret
= krb5_unparse_name (context
, admin_principal
, &admin
);
339 krb5_warn (context
, ret
, "unparse_name failed");
340 reply_priv (auth_context
, s
, sa
, sa_size
,
341 KRB5_KPASSWD_HARDERROR
, "out of memory error");
345 conf
.realm
= principal
->realm
;
346 conf
.mask
|= KADM5_CONFIG_REALM
;
348 ret
= kadm5_init_with_password_ctx(context
,
355 krb5_warn (context
, ret
, "kadm5_init_with_password_ctx");
356 reply_priv (auth_context
, s
, sa
, sa_size
, 2,
361 ret
= krb5_unparse_name(context
, principal
, &client
);
363 krb5_warn (context
, ret
, "unparse_name failed");
364 reply_priv (auth_context
, s
, sa
, sa_size
,
365 KRB5_KPASSWD_HARDERROR
, "out of memory error");
370 * Check password quality if not changing as administrator
373 if (krb5_principal_compare(context
, admin_principal
, principal
) == TRUE
) {
375 pwd_reason
= kadm5_check_password_quality (context
, principal
,
377 if (pwd_reason
!= NULL
) {
379 "%s didn't pass password quality check with error: %s",
381 reply_priv (auth_context
, s
, sa
, sa_size
,
382 KRB5_KPASSWD_SOFTERROR
, pwd_reason
);
385 krb5_warnx (context
, "Changing password for %s", client
);
387 ret
= _kadm5_acl_check_permission(kadm5_handle
, KADM5_PRIV_CPW
,
390 krb5_warn (context
, ret
,
391 "Check ACL failed for %s for changing %s password",
393 reply_priv (auth_context
, s
, sa
, sa_size
,
394 KRB5_KPASSWD_HARDERROR
, "permission denied");
397 krb5_warnx (context
, "%s is changing password for %s", admin
, client
);
400 ret
= krb5_data_realloc(pwd_data
, pwd_data
->length
+ 1);
402 krb5_warn (context
, ret
, "malloc: out of memory");
403 reply_priv (auth_context
, s
, sa
, sa_size
, KRB5_KPASSWD_HARDERROR
,
407 tmp
= pwd_data
->data
;
408 tmp
[pwd_data
->length
- 1] = '\0';
410 ret
= kadm5_s_chpass_principal_cond (kadm5_handle
, principal
, 1, tmp
);
411 krb5_free_data (context
, pwd_data
);
414 const char *str
= krb5_get_error_message(context
, ret
);
415 krb5_warnx(context
, "kadm5_s_chpass_principal_cond: %s", str
);
416 reply_priv (auth_context
, s
, sa
, sa_size
, KRB5_KPASSWD_SOFTERROR
,
417 str
? str
: "Internal error");
418 krb5_free_error_message(context
, str
);
421 reply_priv (auth_context
, s
, sa
, sa_size
, KRB5_KPASSWD_SUCCESS
,
424 free_ChangePasswdDataMS(&chpw
);
425 if (principal
!= admin_principal
)
426 krb5_free_principal(context
, principal
);
432 krb5_free_data(context
, pwd_data
);
434 kadm5_destroy (kadm5_handle
);
438 verify (krb5_auth_context
*auth_context
,
440 krb5_ticket
**ticket
,
448 krb5_address
*client_addr
)
451 uint16_t pkt_len
, pkt_ver
, ap_req_len
;
452 krb5_data ap_req_data
;
453 krb5_data krb_priv_data
;
454 krb5_const_realm client_realm
;
455 krb5_principal sprinc
;
459 * Only send an error reply if the request passes basic length
460 * verification. Otherwise, kpasswdd would reply to every UDP packet,
461 * allowing an attacker to set up a ping-pong DoS attack via a spoofed UDP
462 * packet with a source address of another UDP service that also replies
465 * Also suppress the error reply if ap_req_len is 0, which indicates
466 * either an invalid request or an error packet. An error packet may be
467 * the result of a ping-pong attacker pointing us at another kpasswdd.
469 pkt_len
= (msg
[0] << 8) | (msg
[1]);
470 pkt_ver
= (msg
[2] << 8) | (msg
[3]);
471 ap_req_len
= (msg
[4] << 8) | (msg
[5]);
472 if (pkt_len
!= len
) {
473 krb5_warnx (context
, "Strange len: %ld != %ld",
474 (long)pkt_len
, (long)len
);
477 if (ap_req_len
== 0) {
478 krb5_warnx (context
, "Request is error packet (ap_req_len == 0)");
481 if (pkt_ver
!= KRB5_KPASSWD_VERS_CHANGEPW
&&
482 pkt_ver
!= KRB5_KPASSWD_VERS_SETPW
) {
483 krb5_warnx (context
, "Bad version (%d)", pkt_ver
);
484 reply_error (NULL
, s
, sa
, sa_size
, 0, 1, "Wrong program version");
489 ap_req_data
.data
= msg
+ 6;
490 ap_req_data
.length
= ap_req_len
;
492 ret
= krb5_rd_req (context
,
500 krb5_warn (context
, ret
, "krb5_rd_req");
501 reply_error (NULL
, s
, sa
, sa_size
, ret
, 3, "Authentication failed");
505 if (!(*ticket
)->ticket
.flags
.initial
) {
506 krb5_warnx(context
, "initial flag not set");
507 reply_error((*ticket
)->server
->realm
, s
, sa
, sa_size
, ret
, 1,
513 * The service principal must be kadmin/changepw@CLIENT-REALM, there
514 * is no reason to require the KDC's default realm(s) to be the same
515 * as the realm(s) it serves. The only potential issue is when a KDC
516 * is a master for realm A and a slave for realm B, in which case it
517 * should not accept requests to change passwords for realm B, these
518 * should be sent to realm B's master. This same issue is present in
519 * the checks that only accepted local realms, there is no new risk.
522 client_realm
= krb5_principal_get_realm(context
, (*ticket
)->client
);
523 ret
= krb5_make_principal(context
, &sprinc
, client_realm
,
524 "kadmin", "changepw", NULL
);
527 same
= krb5_principal_compare(context
, sprinc
, (*ticket
)->server
);
528 krb5_free_principal(context
, sprinc
);
533 krb5_unparse_name(context
, (*ticket
)->server
, &sname
);
534 krb5_warnx(context
, "Invalid kpasswd service principal %s", sname
);
536 reply_error(NULL
, s
, sa
, sa_size
, ret
, 1, "Bad request");
539 krb_priv_data
.data
= msg
+ 6 + ap_req_len
;
540 krb_priv_data
.length
= len
- 6 - ap_req_len
;
543 * Only enforce client addresses on on tickets with addresses. If
544 * its addressless, we are guessing its behind NAT and really
545 * can't know this information.
548 if ((*ticket
)->ticket
.caddr
&& (*ticket
)->ticket
.caddr
->len
> 0) {
549 ret
= krb5_auth_con_setaddrs (context
, *auth_context
,
552 krb5_warn (context
, ret
, "krb5_auth_con_setaddr(this)");
557 ret
= krb5_rd_priv (context
,
564 krb5_warn (context
, ret
, "krb5_rd_priv");
565 reply_error ((*ticket
)->server
->realm
, s
, sa
, sa_size
, ret
, 3,
571 krb5_free_ticket (context
, *ticket
);
577 process (krb5_keytab keytab
,
579 krb5_address
*this_addr
,
586 krb5_auth_context auth_context
= NULL
;
589 krb5_address other_addr
;
592 memset(&other_addr
, 0, sizeof(other_addr
));
593 krb5_data_zero (&out_data
);
595 ret
= krb5_auth_con_init (context
, &auth_context
);
597 krb5_warn (context
, ret
, "krb5_auth_con_init");
601 krb5_auth_con_setflags (context
, auth_context
,
602 KRB5_AUTH_CONTEXT_DO_SEQUENCE
);
604 ret
= krb5_sockaddr2address (context
, sa
, &other_addr
);
606 krb5_warn (context
, ret
, "krb5_sockaddr2address");
610 ret
= krb5_auth_con_setaddrs (context
, auth_context
, this_addr
, NULL
);
612 krb5_warn (context
, ret
, "krb5_auth_con_setaddr(this)");
616 if (verify (&auth_context
, keytab
, &ticket
, &out_data
,
617 &version
, s
, sa
, sa_size
, msg
, len
, &other_addr
) == 0)
620 * We always set the client_addr, to assume that the client
621 * can ignore it if it choose to do so (just the server does
622 * so for addressless tickets).
624 ret
= krb5_auth_con_setaddrs (context
, auth_context
,
625 this_addr
, &other_addr
);
627 krb5_warn (context
, ret
, "krb5_auth_con_setaddr(other)");
631 change (auth_context
,
637 memset (out_data
.data
, 0, out_data
.length
);
638 krb5_free_ticket (context
, ticket
);
642 krb5_free_address(context
, &other_addr
);
643 krb5_data_free(&out_data
);
644 krb5_auth_con_free(context
, auth_context
);
648 doit (krb5_keytab keytab
, int port
)
653 krb5_addresses addrs
;
656 struct sockaddr_storage __ss
;
657 struct sockaddr
*sa
= (struct sockaddr
*)&__ss
;
659 if (explicit_addresses
.len
) {
660 addrs
= explicit_addresses
;
662 ret
= krb5_get_all_server_addrs (context
, &addrs
);
664 krb5_err (context
, 1, ret
, "krb5_get_all_server_addrs");
668 sockets
= malloc (n
* sizeof(*sockets
));
670 krb5_errx (context
, 1, "out of memory");
672 FD_ZERO(&real_fdset
);
673 for (i
= 0; i
< n
; ++i
) {
674 krb5_socklen_t sa_size
= sizeof(__ss
);
676 krb5_addr2sockaddr (context
, &addrs
.val
[i
], sa
, &sa_size
, port
);
678 sockets
[i
] = socket (__ss
.ss_family
, SOCK_DGRAM
, 0);
680 krb5_err (context
, 1, errno
, "socket");
681 if (bind (sockets
[i
], sa
, sa_size
) < 0) {
684 int save_errno
= errno
;
686 ret
= krb5_print_address (&addrs
.val
[i
], str
, sizeof(str
), &len
);
688 strlcpy(str
, "unknown address", sizeof(str
));
689 krb5_warn (context
, save_errno
, "bind(%s)", str
);
692 maxfd
= max (maxfd
, sockets
[i
]);
693 if (maxfd
>= FD_SETSIZE
)
694 krb5_errx (context
, 1, "fd too large");
695 FD_SET(sockets
[i
], &real_fdset
);
698 krb5_errx (context
, 1, "No sockets!");
700 while(exit_flag
== 0) {
702 fd_set fdset
= real_fdset
;
704 retx
= select (maxfd
+ 1, &fdset
, NULL
, NULL
, NULL
);
709 krb5_err (context
, 1, errno
, "select");
711 for (i
= 0; i
< n
; ++i
)
712 if (FD_ISSET(sockets
[i
], &fdset
)) {
714 socklen_t addrlen
= sizeof(__ss
);
716 retx
= recvfrom(sockets
[i
], buf
, sizeof(buf
), 0,
722 krb5_err (context
, 1, errno
, "recvfrom");
725 process (keytab
, sockets
[i
],
732 for (i
= 0; i
< n
; ++i
)
736 krb5_free_addresses (context
, &addrs
);
737 krb5_free_context (context
);
747 static const char *check_library
= NULL
;
748 static const char *check_function
= NULL
;
749 static getarg_strings policy_libraries
= { 0, NULL
};
750 static char sHDB
[] = "HDB:";
751 static char *keytab_str
= sHDB
;
752 static char *realm_str
;
753 static int version_flag
;
754 static int help_flag
;
755 static char *port_str
;
756 static char *config_file
;
758 struct getargs args
[] = {
760 { "check-library", 0, arg_string
, &check_library
,
761 "library to load password check function from", "library" },
762 { "check-function", 0, arg_string
, &check_function
,
763 "password check function to load", "function" },
764 { "policy-libraries", 0, arg_strings
, &policy_libraries
,
765 "password check function to load", "function" },
767 { "addresses", 0, arg_strings
, &addresses_str
,
768 "addresses to listen on", "list of addresses" },
769 { "keytab", 'k', arg_string
, &keytab_str
,
770 "keytab to get authentication key from", "kspec" },
771 { "config-file", 'c', arg_string
, &config_file
, NULL
, NULL
},
772 { "realm", 'r', arg_string
, &realm_str
, "default realm", "realm" },
773 { "port", 'p', arg_string
, &port_str
, "port", NULL
},
774 { "version", 0, arg_flag
, &version_flag
, NULL
, NULL
},
775 { "help", 0, arg_flag
, &help_flag
, NULL
, NULL
}
777 int num_args
= sizeof(args
) / sizeof(args
[0]);
780 main (int argc
, char **argv
)
788 krb5_program_setup(&context
, argc
, argv
, args
, num_args
, NULL
);
791 krb5_std_usage(0, args
, num_args
);
797 if (config_file
== NULL
) {
798 aret
= asprintf(&config_file
, "%s/kdc.conf", hdb_db_dir(context
));
800 errx(1, "out of memory");
803 ret
= krb5_prepend_config_files_default(config_file
, &files
);
805 krb5_err(context
, 1, ret
, "getting configuration files");
807 ret
= krb5_set_config_files(context
, files
);
808 krb5_free_config_files(files
);
810 krb5_err(context
, 1, ret
, "reading configuration files");
813 krb5_set_default_realm(context
, realm_str
);
815 krb5_openlog (context
, "kpasswdd", &log_facility
);
816 krb5_set_warn_dest(context
, log_facility
);
818 if (port_str
!= NULL
) {
819 struct servent
*s
= roken_getservbyname (port_str
, "udp");
826 port
= strtol (port_str
, &ptr
, 10);
827 if (port
== 0 && ptr
== port_str
)
828 krb5_errx (context
, 1, "bad port `%s'", port_str
);
832 port
= krb5_getportbyname (context
, "kpasswd", "udp", KPASSWD_PORT
);
834 ret
= krb5_kt_register(context
, &hdb_kt_ops
);
836 krb5_err(context
, 1, ret
, "krb5_kt_register");
838 ret
= krb5_kt_resolve(context
, keytab_str
, &keytab
);
840 krb5_err(context
, 1, ret
, "%s", keytab_str
);
842 kadm5_setup_passwd_quality_check (context
, check_library
, check_function
);
844 for (i
= 0; i
< policy_libraries
.num_strings
; i
++) {
845 ret
= kadm5_add_passwd_quality_verifier(context
,
846 policy_libraries
.strings
[i
]);
848 krb5_err(context
, 1, ret
, "kadm5_add_passwd_quality_verifier");
850 ret
= kadm5_add_passwd_quality_verifier(context
, NULL
);
852 krb5_err(context
, 1, ret
, "kadm5_add_passwd_quality_verifier");
855 explicit_addresses
.len
= 0;
857 if (addresses_str
.num_strings
) {
860 for (j
= 0; j
< addresses_str
.num_strings
; ++j
)
861 add_one_address (addresses_str
.strings
[j
], j
== 0);
862 free_getarg_strings (&addresses_str
);
864 char **foo
= krb5_config_get_strings (context
, NULL
,
865 "kdc", "addresses", NULL
);
868 add_one_address (*foo
++, TRUE
);
870 add_one_address (*foo
++, FALSE
);
874 #ifdef HAVE_SIGACTION
879 sa
.sa_handler
= sigterm
;
880 sigemptyset(&sa
.sa_mask
);
882 sigaction(SIGINT
, &sa
, NULL
);
883 sigaction(SIGTERM
, &sa
, NULL
);
886 signal(SIGINT
, sigterm
);
887 signal(SIGTERM
, sigterm
);
892 return doit (keytab
, port
);